Add areas

joefarebrother · joefarebrother · commit 7194113a6461 · 2023-11-23T10:56:42.000Z
diff --git a/csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSFlowSteps.qll b/csharp/ql/lib/semmle/code/csharp/security/dataflow/XSSFlowSteps.qll
@@ -58,6 +58,15 @@ private class ViewCall extends MethodCall {
 
   /** Gets the name of the MVC controller that this call is made from, if any. */
   string getControllerName() { result + "Controller" = this.getController().getName() }
+
+  /** Gets the name of the Area that the controller of this call belongs to, if any. */
+  string getAreaName() {
+    exists(Attribute attr |
+      attr = this.getController().getAnAttribute() and
+      attr.getType().hasQualifiedName("Microsoft.AspNetCore.Mvc", "AreaAttribute") and
+      result = attr.getArgument(0).(StringLiteral).getValue()
+    )
+  }
 }
 
 /** A compiler-generated Razor page. */
@@ -110,17 +119,21 @@ private predicate viewCallRefersToPageRelative(ViewCall vc, RazorPage rp) {
 
 /** Gets the `i`th template for view discovery. */
 private string getViewSearchTemplate(int i) {
-  i = 0 and result = "/Views/{1}/{0}.cshtml"
+  i = 0 and result = "/Areas/{2}/Views/{1}/{0}.cshtml"
+  or
+  i = 1 and result = "/Areas/{2}/Views/Shared/{0}.cshtml"
   or
-  i = 1 and result = "/Views/Shared/{0}.cshtml"
+  i = 2 and result = "/Views/{1}/{0}.cshtml"
   or
-  i = 2 and result = getAViewSearchTemplateInCode()
+  i = 3 and result = "/Views/Shared/{0}.cshtml"
+  or
+  i = 4 and result = getAViewSearchTemplateInCode()
 }
 
 /** Gets an additional template used for view discovery defined in code. */
 private string getAViewSearchTemplateInCode() {
   exists(StringLiteral str, MethodCall addCall |
-    addCall.getTarget().hasQualifiedName("System.Collections.Generic", "IList", "Add") and
+    addCall.getTarget().hasName("Add") and
     DataFlow::localExprFlow(str, addCall.getArgument(0)) and
     addCall.getQualifier() = getAViewLocationList() and
     result = str.getValue()
@@ -134,8 +147,8 @@ private Expr getAViewLocationList() {
       .getProperty()
       .hasQualifiedName("Microsoft.AspNetCore.Mvc.Razor", "RazorViewEngineOptions",
         [
-          "ViewLocationFormats", "PageViewLocationFormats", "AreaViewLocationFormats",
-          "AreaPageViewLocationFormats"
+          "ViewLocationFormats", "AreaViewLocationFormats",
+          //"PageViewLocationFormats","AreaPageViewLocationFormats"
         ])
 }
 
@@ -145,13 +158,21 @@ private class RelativeViewCallFilepath extends NormalizableFilepath {
   int idx_;
 
   RelativeViewCallFilepath() {
-    exists(string template | template = getViewSearchTemplate(idx_) |
-      this =
-        template.replaceAll("{0}", vc_.getActionName()).replaceAll("{1}", vc_.getControllerName())
-      or
-      not exists(vc_.getControllerName()) and
-      not template.matches("%{1}%") and
-      this = template.replaceAll("{0}", vc_.getActionName())
+    exists(string template, string sub2, string sub1, string sub0 |
+      template = getViewSearchTemplate(idx_)
+    |
+      (
+        if template.matches("%{2}%")
+        then sub2 = template.replaceAll("{2}", vc_.getAreaName())
+        else sub2 = template
+      ) and
+      (
+        if template.matches("%{1}%")
+        then sub1 = sub2.replaceAll("{1}", vc_.getControllerName())
+        else sub1 = sub2
+      ) and
+      sub0 = sub1.replaceAll("{0}", vc_.getActionName()) and
+      this = sub0
     )
   }
 
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Controllers/TestController.cs b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/Controllers/TestController.cs
@@ -3,6 +3,7 @@ namespace test;
 using System.Net;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.RazorPages;
+using Microsoft.AspNetCore.Mvc.Razor;
 
 public class UserData
 {
@@ -79,12 +80,12 @@ private IActionResult helper2(UserData x) {
     }    
 
     private IActionResult test13(UserData tainted13) {
-        // Expected to find file /Views/Other/Test13.cshtml
+        // MISSING: Expected to find file /Views/Other/Test13.cshtml. 
         return Helper.helper3(this, tainted13);
     }
 
     private IActionResult test14(UserData tainted14) {
-        // Expected to find file /Views/Shared/Test14.cshtml and NOT /Views/Test2/Test14.cshtml
+        // MISSING: Expected to find file /Views/Shared/Test14.cshtml and NOT /Views/Test2/Test14.cshtml
         return Helper.helper4(this, tainted14);
     }
 
@@ -101,8 +102,8 @@ public void Setup(RazorViewEngineOptions o) {
         o.ViewLocationFormats.Add("/Views/Custom/{1}/{0}.cshtml");
     }
 
-    private IActionResult Test15(UserData tainted14) {
-        // Expected to find file /Views/Custom/Test3/Test15.cshtml
-        return View(x);
+    private IActionResult Test15(UserData tainted15) {
+        // MISSING: Expected to find file /Views/Custom/Test3/Test15.cshtml
+        return View(tainted15);
     }
 }
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.expected b/csharp/ql/test/query-tests/Security Features/CWE-079/XSSRazorPages/XSS.expected

Original file line number	Diff line number	Diff line change
`@@ -3,6 +3,7 @@ namespace test;`
`3`	`3`	`using System.Net;`
`4`	`4`	`using Microsoft.AspNetCore.Mvc;`
`5`	`5`	`using Microsoft.AspNetCore.Mvc.RazorPages;`
	`6`	`+using Microsoft.AspNetCore.Mvc.Razor;`
`6`	`7`
`7`	`8`	`public class UserData`
`8`	`9`	`{`
`@@ -79,12 +80,12 @@ private IActionResult helper2(UserData x) {`
`79`	`80`	`}`
`80`	`81`
`81`	`82`	`private IActionResult test13(UserData tainted13) {`
`82`		`- // Expected to find file /Views/Other/Test13.cshtml`
	`83`	`+ // MISSING: Expected to find file /Views/Other/Test13.cshtml.`
`83`	`84`	`return Helper.helper3(this, tainted13);`
`84`	`85`	`}`
`85`	`86`
`86`	`87`	`private IActionResult test14(UserData tainted14) {`
`87`		`- // Expected to find file /Views/Shared/Test14.cshtml and NOT /Views/Test2/Test14.cshtml`
	`88`	`+ // MISSING: Expected to find file /Views/Shared/Test14.cshtml and NOT /Views/Test2/Test14.cshtml`
`88`	`89`	`return Helper.helper4(this, tainted14);`
`89`	`90`	`}`
`90`	`91`
`@@ -101,8 +102,8 @@ public void Setup(RazorViewEngineOptions o) {`
`101`	`102`	`o.ViewLocationFormats.Add("/Views/Custom/{1}/{0}.cshtml");`
`102`	`103`	`}`
`103`	`104`
`104`		`- private IActionResult Test15(UserData tainted14) {`
`105`		`- // Expected to find file /Views/Custom/Test3/Test15.cshtml`
`106`		`- return View(x);`
	`105`	`+ private IActionResult Test15(UserData tainted15) {`
	`106`	`+ // MISSING: Expected to find file /Views/Custom/Test3/Test15.cshtml`
	`107`	`+ return View(tainted15);`
`107`	`108`	`}`
`108`	`109`	`}`